Authors Ritu Gill & Ginger T
After conducting some LinkedIn research recently, I noticed several differences between how Google and Bing returned results and the information contained within them. I posted some tips on Twitter and Ritu Gill @OSINTtechniques, also posted some in her reply. So we decided to get together to write this article on our experiences of searching LinkedIn.
I have had a renewed interest in researching LinkedIn recently and noticed some interesting traits both Google & Bing have in relation to how they deal with LinkedIn searches.
Linkedin simply does not play well with Google, yes you may occasionally be allowed to click through to a profile’s landing page but try and click around anywhere else and you will be asked to sign in. Alternatively if you come out of that profile and try to click in another then you will be asked to sign in.
With Bing however you have more of a chance of being able to access the landing page of an account and also click around in the account to other accounts. You can also go back to your search results and click in another account.
Spoiler alert, I am assuming that because LinkedIn and Bing are both owned by Microsoft that they play better together and nasty Google isn’t allowed in the club. Probably makes a sensible business model. I have also been able to use a VPN but I have found that my access to accounts does not last as long as without using one, that said I cannot provide any evidence to the consistency of the access I get as it appears to change frequently. Clearly I do not know what LinkedIn’s algorithms are doing in the background to determine whether or not it lets me in.
If you are able to obtain enough information about your subject from Google then you should be able to do a simple search on Bing with your keywords and Bing will present the profile at the top of the results with an accompanying profile picture. Then you should be able to access the landing page.
If you think you have a photograph that has originated from LinkedIn, the tests I have done Bing was better at finding the profile, Google & Yandex were not able to find any that I tested.
So let’s have a look at the above in action. I am not going to get over specific or complicated with the advanced operators or keywords. I am going to look at a UK based company using a UK IP address.
I will use the below search string on Google and Bing, “intext” & “inbody” have a similar function:-
site:linkedin.com intitle:”shell” intext:”finance” “london”
site:linkedin.com intitle:”shell” inbody:”finance” “london”
As you can see from the above widely different results. Bing will however provide you with the LinkedIn profile url details and more bio information, which I have redacted for privacy reasons. We can alter the search string on both Google & Bing to:-
site:linkedin.com intitle:”shell” intitle: “finance” “london”
You will see from the above that the result count is similar but the rankings are different. We can alter the search string again using different operators and keywords, however that is not the main aim of this article. It is about demonstrating how we can use Google & Bing together to find our subject or entity.
When I click on the image tab on Google I get images of people linked to Shell: –
However when I click on the same tab on Bing, I get this: –
When I click into a randomly chosen profile on Google I get this: –
However when I click on the same random profile on Bing, it lets me in: –
What if you are faced with a situation where you have located the profile on Google but can’t see it on Bing. We can obtain as much information from the bio that we can see and do a straightforward search on Bing.
Even though there is over 1.8 million results it has listed our subject at the top. If they have a public facing profile picture they will show you that too. All we have to do then is because we have used Bing is click into the profile: –
X Number of Employees
When you are conducting your open source research you may identify a company that states an X number of employees work at that company. For instamce, “7 employees” as noted in the below noted screenshot but LinkedIn does not always outright indicate who those 7 employees are. LinkedIn usually will identify some of those employees but several of them will only state “LinkedIn member”.
One of the workarounds to identify those employees is to search Google for the unique title such as “Director of Business Development for X company”. Often this will identify the employee’s name. I have found this extremely helpful with identifying many, if not all employees associated to a company. This is a pivot point in your OSINT research where you can then continue your research on those entities.
This same technique can be used in a situation where LinkedIn users who only display their first name and the initial of their surname. The work around here is to Google their unique title in quotes. This can sometimes display their full name. Remember to always check the LinkedIn URL to see if the username it displays is their full name as LinkedIn members have the option of customizing the username.
Some tips once a LinkedIn profile is identified:
1. Once I have identified a LinkedIn user, an important place to look is “contact info” as this often can have the subject’s website, social media profiles, or other important associations. These can contain additional pivot points to leverage.
2. If I want to find more information regarding activity on a LinkedIn profile check the recent activity of that user. You can find the recent activity for a user by adding “detail/recent-activity” to the end of a LinkedIn profile.
For instance, https://www.linkedin.com/in/ritu-gill-osint-techniques-3baa14195 would look like this: https://www.linkedin.com/in/ritu-gill-osint-techniques-3baa14195/detail/recent-activity/
3. Another tip is to conduct a reverse image search of the profile photo to identify other places the photo is posted, i.e. another blog, perhaps another social media platform. Keep in mind no metadata will be available from the profile photo. LinkedIn removes this data from the image prior to uploading to their site. Of course, if you are law enforcement, this information may be available via the legal application process.
4. For this next example, let’s say you Google “Ritu Gill osint” and locate a profile related to OSINT Techniques. When you click on the LinkedIn URL you may receive the sign in prompt. To see if an account uses a profile photo without logging into LinkedIn, you can follow these steps:
– Copy the link of the LinkedIn profile by right clicking and selecting “copy link address”
– Compose an email in Outlook, paste the URL in the body of the email
Using this technique you can identify a profile photo if one is associated with that account. This may be useful if someone doesn’t have a LinkedIn research account but needs to know if the target uses a profile photo.
Copyright 2021 © cqcore & Ritu Gill All Rights Reserved